pending-moonshot[.]com

pending-moonshot.com was registered on March 11, 2026 via Hello Internet Corp. The zone is served by the Cloudflare authoritative nameservers jerome.ns.cloudflare.com and kim.ns.cloudflare.com, and the site presents a valid Let’s Encrypt certificate (E7). An HTTP 301 response is observed, and the page title returned by the server is “Vote to List — Powered by Moonshot”, directly referencing the targeted brand.

Infrastructure analysis shows the domain resolves to 172.67.179.220, an address owned by AS13335 Cloudflare, Inc. and geolocated to the United States. The IP is listed on three public security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal reports a single detection out of ninety‑five scanning engines, while AlienVault OTX cites the domain in twenty‑two separate threat‑intel pulses. The same IP receives a Gridinsoft trust score of 0 / 100, indicating a lack of reputational confidence.

The observed title and the explicit brand reference indicate a brand‑impersonation campaign that masquerades as a legitimate Moonshot service to solicit cryptocurrency payments. The threat is classified as high risk and remains active at the time of this assessment. Use of a legitimate TLS certificate and Cloudflare’s CDN likely serves to increase perceived legitimacy and to bypass basic URL‑based filtering mechanisms.

Defenders should add pending-moonshot.com to network and endpoint blocklists, enforce DNS sinkholing for the domain and its associated IP, and monitor for any new indicators of compromise in threat‑intel feeds. User education should emphasize that unsolicited messages invoking Moonshot and requesting cryptocurrency transfers are malicious, and that the presence of a valid HTTPS certificate does not guarantee safety.